The correct answer is Attack simulation training. This feature is specifically intended to evaluate employees' reactions to simulated phishing messages and to measure how users respond over time.

Attack simulation training enables administrators to create or use predefined phishing scenarios and deliver them to targeted groups. The tool records outcomes such as who clicked links who submitted credentials and who completed follow up training so security teams can identify risk and track improvement.

Threat analytics is incorrect because it provides insights into active threats trends and campaign context rather than running simulations to test user behavior.

Automated investigation and response is incorrect because it focuses on automating detection investigation and remediation tasks for alerts and incidents and does not perform phishing simulations or user training.

Safe Links policy is incorrect because it protects users by scanning and rewriting URLs and blocking malicious links in messages and does not evaluate employee reactions to simulated phishing.

Full AWS Practitioner Certification Question